From mpark@cmu.edu Sat Jan 22 03:57:48 1994
Path: ashpoly!cascade!mxgate!coyoacan!cmu!mpark
From: mpark@cmu.edu (Matthias Park)
Newsgroups: comp.sys.m68k
Subject: Discussion: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1994Jan22.035748.9473@cmu.edu>
Date: Sat, 22 Jan 1994 03:57:48 GMT
Organization: Carnegie Mellon University School of CS
NNTP-Posting-Host: cmu.edu
X-Newsreader: TIN [version 1.2 PL2]
Lines: 10

Hardware disassembly report for Motorola hardware hackers.

This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream.
The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle.

Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'?

-- 
Matthias Park -- Carnegie Mellon University School of CS
"When every node is whole, the channel opens."

From keriksson@uu.net Sun Jan 23 12:34:48 1994
Path: ashpoly!cascade!mxgate!coyoacan!uu!keriksson
From: keriksson@uu.net (Karen Eriksson)
Newsgroups: comp.sys.m68k
Subject: Re: Discussion: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1994Jan23.123448.1789@uu.net>
Date: Sun, 23 Jan 1994 12:34:48 GMT
References: <1994Jan22.035748.9473@cmu.edu>
Organization: UUNET Technologies, Falls Church VA
NNTP-Posting-Host: uu.net
X-Newsreader: WinVN 0.99.5
Lines: 10

In article <1994Jan22.035748.9473@cmu.edu>, mpark@cmu.edu (Matthias Park) writes:
> Hardware disassembly report for Motorola hardware hackers.
> This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream.

If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack!

-- 
Karen Eriksson | keriksson@uu.net
PGP Key fingerprint: 9E87 F6D0 573E 779B
"Keep the channels open."

From tsouza@purdue.edu Tue Jan 25 16:18:48 1994
Path: ashpoly!cascade!transat!eunet-de!hansebox!purdue!tsouza
From: tsouza@purdue.edu (Tomas Souza)
Newsgroups: comp.sys.m68k
Subject: Re: Discussion: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1994Jan25.161848.9130@purdue.edu>
Date: Tue, 25 Jan 1994 16:18:48 GMT
References: <1994Jan22.035748.9473@cmu.edu> <1994Jan23.123448.1789@uu.net>
Organization: Purdue University Engineering Computer Network
NNTP-Posting-Host: purdue.edu
X-Newsreader: Netscape 1.1N
Lines: 9

In article <1994Jan23.123448.1789@uu.net>, keriksson@uu.net (Karen Eriksson) writes:
> If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack!

Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984.

-- 
Tomas Souza | tsouza@purdue.edu
PGP Key fingerprint: A0EF 18E5 FB9F 0476
"Keep the channels open."